Privacy Policy

We collect information you provide directly when you create an account, complete onboarding, request services, manage shifts, or contact support.

Depending on how you use the platform, this may include your name, email address, phone number, account credentials, scheduling details, profile information, uploaded documents, and service-related notes.

We use personal information to operate the Noa Base platform, provide scheduling and care-management services, communicate with users, maintain security, and meet legal or regulatory obligations.

We may also use information to troubleshoot issues, improve product performance, and protect the rights, safety, and integrity of our users, staff, and systems.

We do not sell personal information. Authorized People V Care staff and platform users may access information needed for their roles, including care coordination, scheduling, attendance, payroll, billing, and support.

We use the service providers described below to operate the platform. Sharing includes sending information for an API request or security check, even when we do not save that request as a platform record. Each provider receives information relevant to the service it performs; providers do not all receive the same information.

We may also disclose information when required by law, to respond to lawful requests, to enforce our agreements, or to protect users, clients, employees, or the public.

We use Supabase for authentication, our application database, uploaded file storage, and server functions. Supabase processes and stores account and sign-in information, profiles, scheduling and attendance records, saved addresses and coordinates, care-related records, financial records, and uploaded documents and photos, depending on the features you use.

This is ongoing storage of platform records, not just a temporary lookup. Supabase also processes technical and security logs associated with these services. Its handling of customer data is subject to the applicable service and data-processing terms.

We use the Google Places API, part of Google Maps Platform, to suggest addresses and retrieve details and coordinates for a selected place. Our server sends Google the address search text you enter, the selected place identifier, and a search-session token when available. Google also receives technical information associated with the API request.

We do not keep autocomplete suggestions as a search-history record. When you save a profile or shift, the selected address, place identifier, and coordinates may be stored in Noa Base through Supabase for service coordination and worksite verification.

Google processes these lookups under its own terms and privacy policy, which allow it to use and retain request data to provide and improve its services. A lookup does not mean that Google stores no information. If you open a Google Maps link, the address or location in that link is shared with Google and your use of Google Maps is also subject to Google's policies.

A company's owner may connect the company's own Microsoft 365 or Google mailbox so that its invoices, pay stubs, or scheduling messages are sent from that mailbox. We request permission only to send mail as that mailbox and to read its address; we do not read, search, or store the mailbox's contents.

When a connected mailbox sends a message, Microsoft or Google receives the recipient email address, message subject and contents, and any attachments, which may contain personal or financial information, and keeps a copy in the mailbox's sent items under the company's own account terms. The authorization token is stored encrypted in that company's workspace and is deleted when the mailbox is disconnected.

We use Cloudflare Email Sending to deliver Noa Base account confirmation, sign-in, verification, email-change, invitation, and password-recovery messages, and to send a company's invoices, pay stubs, and scheduling messages on its behalf when it has not connected its own mailbox. Cloudflare receives the recipient email address, message subject and content, any attachments or authentication link or code, and delivery metadata needed to process and deliver the message.

Account messages are sent from an unmonitored Noa Base address. Company messages name the company, state that Noa Base sent them on its behalf, and direct replies to the company where it has provided a contact address. Cloudflare processes the message and delivery information under its service terms and privacy policy. Your email provider also receives messages delivered to your mailbox.

We use Cloudflare Turnstile on protected forms to help distinguish legitimate visitors from automated abuse. Cloudflare processes technical signals such as your IP address, browser and device information, and challenge interactions. Our server sends the verification token, and an IP address when supplied, to Cloudflare to check the result.

This processing supports security rather than storage of your care or payroll records. Cloudflare's handling of Turnstile data is described in its Turnstile Privacy Addendum.

When you use a feature that requests your current location, such as clocking in or out or setting worksite coordinates, your browser asks for location permission unless you have already made that choice. Submitted attendance coordinates are retained with the attendance record in Supabase to verify attendance against the worksite. The platform does not continuously track your location in the background.

You can manage or revoke location permission in your browser or device settings. Disabling it may prevent location-based attendance verification; contact People V Care for assistance. Your browser or device provider may also process information to determine your location under its own privacy settings and policies.

Our service providers may use other companies to deliver their services, such as infrastructure and support providers. Information may be processed or stored outside your province or Canada, depending on the provider and service configuration, and may be accessible to authorities under the laws of those jurisdictions.

Provider retention can differ from our platform-record retention, including for security logs, backups, and delivery records. Contact us through the People V Care contact page below for information about our providers and the handling of your personal information.

We retain information for as long as reasonably necessary to provide services, maintain records, resolve disputes, enforce agreements, and comply with applicable legal obligations.

We use administrative, technical, and organizational measures designed to protect personal information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

You may request access to, correction of, or updates to your personal information by contacting us. Where required by applicable law, you may also have additional rights related to deletion, restriction, objection, or portability.

If you no longer wish to use the service, you may contact us to request account assistance, subject to any records we must keep for legal, regulatory, safety, or operational reasons.

We may update this Privacy Policy from time to time to reflect changes in our services, operations, or legal obligations. When we do, we will update the effective date shown on this page.